R2026-07-RT (monthly release cumulative patch)

Introduction

This patch is cumulative. It includes the previous generally available patches from Talend ESB Runtime 8.0.1.R2026-06-RT.

NOTE:

• To download this patch, contact Talend Support.
• Keeping Studio and Talend Runtime versions in sync is highly recommended. Using unaligned versions is a risk.

Prerequisites

This patch must be installed on top of Talend ESB Runtime release version 8.0.1.R2025-02-RT (Camel 4) patched with patch 8.0.1.R2026-06, release version 8.0.1.R2026-06-RT (Camel 4), or later. The installation on an older Talend ESB Runtime version will be rejected. More information about the installation of this version is available in the online documentation: https://help.talend.com/r/en-US/Cloud/installation-guide-linux/upgrading-runtime.

Installation

Depending on the product, {container} is Talend-ESB-V8.0.1.R2026-06-RT/container/ or Talend-Runtime-V8.0.1.R2026-06-RT/

For all inserted properties:

• if property already present (commented or uncommented), won't insert
• if property not already present, will backup related file in dir {container}/patches/Patch_20260724_R2026-07_v1-RT-8.0.1.R2026-06-RT/backup/ and insert property

For all updated properties:

• if property commented or not already present, won't update
• if property already present, will backup related file in dir {container}/patches/Patch_20260724_R2026-07_v1-RT-8.0.1.R2026-06-RT/backup/ and update property

If any change required, update value after patch execution.

Installation Steps

• Start Runtime Container
• Extract & replace the content of ZIP directory container into {container} directory

Structure after extract & replace should be :

{container}
├───bin     : existing dir
├───deploy  : existing dir
├───etc     : existing dir
├───...
├───patches : dir from current or previous patch
│   └───Patch_20260724_R2026-07_v1-RT-8.0.1.R2026-06-RT
│           patch.bat
│           patch01.commands
│           patch02.commands
│           patch03.commands
│           patch.sh
│           talend-esb-patch-<version>.jar
│           logs/ : directory for logs installation
├───system  : existing dir
│   ├───... : existing dir
├───...

• Execute {container}/patches/Patch_20260724_R2026-07_v1-RT-8.0.1.R2026-06-RT/patch.bat or {container}/patches/Patch_20260724_R2026-07_v1-RT-8.0.1.R2026-06-RT/patch.sh

  Credentials are resolved in the following order of priority:

  1. Command-line arguments: --username <user> --password <pass>
  2. Environment variables: TESB_USER and TESB_PASSWORD
  3. Interactive prompt: if neither of the above is set, the script prompts for credentials on stdin (password input is masked)
• Ensure directory {container}/patches/Patch_20260724_R2026-07_v1-RT-8.0.1.R2026-06-RT/logs contains new log files :
  • xxx-installation.log: patch installation logs
  • xxx-init.log: state before patch installation
  • xxx-installed.log: state after patch installation

Please note that Routes using cMap (TDM feature) are not automatically restarted by the patch procedure. You will need to restart the Runtime Container for changes to take effect.

This patch enforces replacement of the default passwords for the system users tadmin, tesb, and karaf. If default passwords are detected, patch application fails by default. The user has two options:

• Change the passwords manually in etc/users.properties and restart the patch
• Restart the patch with the --ignore-default-passwords option to leave the default passwords unchanged (security risk!). If the default passwords are not replaced, SSH access to the Talend ESB Runtime is restricted to 127.0.0.1. The corresponding property is sshHost in etc/org.apache.karaf.shell.cfg

This patch enforced encryption of the Talend ESB Runtime user passwords in etc/users.properties. In order to complete the removal of unencrypted system user passwords from configurations and startup scripts, edit bin/setsecenv and bin/setsecenv.bat or <service name>-wrapper.conf if installed as a service:

1. Find the new environment variable definitions and remove the _NEW suffix
2. For each environment variable in 1., delete the previous definition of the same variable with a cleartext password
3. Restart Talend ESB Runtime

For complete credential storage rules and configuration instructions, see the 2026-06 patch release notes.

Warning: JRE 17.0.8 may refuse to open JAR or other ZIP files from Talend ESB Runtime or the patch installer. They complain about invalid CEN headers. This is caused by an incompatibility with JARs and other ZIP files created by commonly used Apache tools. It has been fixed with 17.0.9, and you need to upgrade your JRE to 17.0.9 or later.

Warning: This patch disables the usually unused JobServer monitoring port for security reasons. Furthermore, COMMAND_SERVER_HOST, FILE_SERVER_HOST, and PROCESS_MESSAGE_HOST are restricted to localhost. If you are using the Talend ESB Runtime with TAC to run DI jobs instead of a separate standalone JobServer, you may get errors in TAC. In this case, re-enable the JobServer monitoring port in etc/org.talend.remote.jobserver.server.cfg. Set org.talend.remote.jobserver.server.TalendJobServer.ENABLE_MONITORING_PORT=true. Moreover, comment out the properties termination with _HOST or set them 0.0.0.0 for remote access from TAC.

Notes

Bundle resolution errors and patch process duration

The updates are performed in 2 iterations. During the first iteration, bundle resolution errors might show up in the console and logs. This is expected, as the errors are resolved in the second (final) iteration. The total patch process takes several minutes and depends on the number and nature of patch updates, the deployments present in the Talend ESB Runtime, and the system's hardware. The patch bundle restarts automatically multiple times, one log file is created at each restart. The estimate of remaining patch time is currently disabled by default as it causes issues with cxf update.

R2026-07

Issues fixed in 2026-07

• DPE-3724 Talend ESB runtime 8.0.1 Camel 4: CVE fixes for R2026-07
• DPE-3467 Talend ESB runtime 8.0.1 Camel 4: Backport of CXF XKMS repository LDAP query fix
• DPE-2473 consolidate patch installation logs into a single file

CVE fixed in 2026-07

• CVE-2026-54512|CVE-2026-54513|CVE-2026-54514|CVE-2026-54515|CVE-2026-54516|CVE-2026-54517|CVE-2026-54518 -- com.fasterxml.jackson (all components) 2.21.2 -> 2.22.1
• CVE-2026-42583|CVE-2026-44249|CVE-2026-45416|CVE-2026-50010|CVE-2026-45674|CVE-2026-47691|CVE-2026-45673|CVE-2026-45536 -- io.netty (all components) 4.1.133.Final -> 4.1.135.Final
• CVE-2025-53114 org.cometd.java (all components) 8.0.4 -> 8.0.12
• CVE-2026-43869 org.apache.thrift:libthrift 0.20.0 -> 0.23.0
• CVE-2026-47065 org.apache.mina:mina-core 2.2.7 -> 2.2.8
• CVE-2026-35563 org.apache.directory.api (all components) 2.0.0 -> 2.1.8
• CVE-2026-49268 org.apache.shiro (all components) 2.1.0 -> 2.2.1
• CVE-2026-6860 io.vertx (all components) 4.5.24 -> 4.5.29
• CVE-2026-44930 org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap 4.1.0.2 -> 4.1.0.2.20260701 -- backport of cxf-services-xkms-x509-repo-ldap from CXF 4.1.6

TDM

• QTDM-1854 [commons-io] Missing shaded commons.io in tdm-lib-di
• QTDM-1873 Update TDM maplang libraries to new version 1.24.1
• QTDM-1849 [security] upgrade jackson-databind version in the swagger-parser-v3-shade lib
• QTDM-1792 [ESB] Eclipse runtime feature needs to depend on older target env
• QTDM-1822 Add SqlAnyWhere Database Type
• QTDM-1561 TestRun produces different results in the XML and CSV representations
• QTDM-1814 Remove MySQL5 from TDM databases
• QTDM-1668 Update http/https support for ReadURL
• QTDM-1756 Unable to read an output created with CSV representation
• QTDM-1817 Upgrade com.fasterxml.jackson.core version in TDM components
• QTDM-1791 [targetenv] Upgrade JDBC database drivers

• QTDM-1881 [ESB] patch_ESB fails with missing library in osdt-targetenv 4.30

• QTDM-1722 [security] Remove XMLReader from EdiSaxReader

• QTDM-1759 Output xml with JSON rep namespace when iso map is enabled
• QTDM-1771 Error related to driver Jtds with SqlServer Database
• QTDM-1784 [transform] Update to 8.0.3-SNAPSHOT with recommended dependency repo
• QTDM-1758 Upgrade Eclipse to R2026-03. Need Java 21.
• QTDM-1719 Remove swagger-parser-v3-shade from org.talend.transform.parser.oas

R2026-06

Issues fixed in 2026-06

DPE

For previous patches : see 2026-06 patch release notes